Policy-as-Code
Policy-as-code is the practice of expressing authorization and governance rules as version-controlled, machine-evaluable code rather than as prose documents or manual configuration. The policy lives in a repository, goes through code review, and is enforced automatically at runtime by an engine that evaluates each request against the rules. Open Policy Agent and its Rego language are a common implementation. For AI systems, policy-as-code turns statements like which roles may call which models with which data into rules a gateway can evaluate on every request, and into a diffable history of how those rules changed.
How policy-as-code works
Instead of a written policy that a human interprets, policy-as-code defines rules in a formal language that an engine evaluates deterministically. A request arrives with attributes (the identity, the role, the route, the payload classification), the engine checks it against the codified rules, and returns an allow or deny decision. Because the rules are code, they are versioned in git, reviewed before merge, tested, and rolled back like any other software change.
Why AI governance benefits from it
AI usage policies are often written as documents that no system enforces, which leaves a gap between the stated rule and the actual request. Policy-as-code closes that gap by making the rule the thing that runs. DeepInspect evaluates per-route and per-role policy on each AI request at the HTTP boundary and produces a per-decision audit record, so the policy that governs AI traffic is both enforced automatically and preserved as versioned, reviewable history. When an auditor asks what the rule was on a given date, the answer is a specific commit.
Related reading
- AI Policy as Code: The Declarative Pattern That Makes Enforcement Auditable
AI policy as code expresses the rules that govern AI usage in a declarative configuration format checked into version control, evaluated at the AI request boundary, and versioned per decision in the audit record. The pattern differs from policy as documents at three points: machine-readable expression that the gate evaluates directly, version control that ties each decision to the policy in effect at the moment, and code review that captures the change history. I walk through what the policy actually contains, how the gate evaluates it, and how the audit record references it.
- Policy as Code for AI: The Review Pipeline That Turns AI Policy From a Config Screen Into a Reviewed Artifact
AI policies expressed as configuration screens inside a gateway UI change without version control, without code review, and without a rollback plan. The same policies expressed as code (Rego, Cedar, or JSON schemas checked into git) inherit the review pipeline the rest of the codebase runs on. This covers the operational pattern, the language choices, and how policy-as-code maps to SOC 2 CC8.1, ISO 27001 8.28, and EU AI Act Article 26 change management.